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WHAT IS CLAIMED IS: 

1 . A method for using a binary state machine for 
processing a data stream in an intrusion detection 
systeT\, the method comprising: 

maintaining a state table, the state table 
indexed Xsuch that inputs comprising a current state and a 
current character yield an output of a new state, the new 
state relao^d to an indication of an attack on a computer 
network; 

maintaining the current state; 

receWing an input stream, the input stream 
comprising a plurality of characters; 

selectirig a first character of the input stream 
as the current character; and 

comparing V current character and the current 
state to the state taWe to generate a new state. 
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2. The method of ylaim 1, further comprising 
initializing the current ^tate to an initial state. 

3. The method of ClaiV 1, further comprising: 
setting the current \^tate equal to the new 

state ; 

selecting a next character as the current 
character, the next character appearing subsequent to the 
first character in the input strean\ and 

repeating the comparing st^. 



4. The method of Claim 1, furtheV comprising 
3 0 recognizing the new state as indicative \f an attack upon 
the computer network. 
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^^.^^ A system for use as a binary state machine for 
prc)»f:essing a data stream in an intrusion detection 
^m, the system comprising: 

a state table indexed such that inputs 
comprising a current state and a current character yield 
an outpul\ of a new state, the new state related to an 
attack on V computer network; and 

aXstate machine communicatively coupled to the 
state table, \he state machine operable to: 
Sjnaintain the current state; 

iceive an input stream, the input stream 
comprising a plursility of characters; 

select a first character of the input 
stream as the currents character; and 

compare^ the current character and the 
current state to the stWte table to generate a new state. 



8 . The system of Craim 7 further comprising a 
computer readable medium, wkerein the state table is 
2 0 stored upon the computer reacmble medium. 
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9. The system of Claim 8, \ wherein the state 
machine comprises software code stored upon the computer 
readable medium, the software code \urther operable to be 
executed by a computer processor. 
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10. The system of Claim 7, whereins^the state 
machine is further operable to initialize\the current 
state to an initial state. 
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.1. The system of Claim 7, wherein the state 
machine^H^ further operable to: 

s$<;^ing the current state equal to the new 

state ; 

selectinq'xa next character as the current 
character, the next cha^is^ter appearing subsequent to the 
first character in the inpubs^tream; and 
repeating the comparing, step . 



12. The system of Claim 7, wherersi the state 
machine is further operable to recognizingSthe new state 
as indicative of an attack upon the computer network. 
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A system for use as an intrusion detection 
system^ the system comprising: 

\ a computer readable medium; 

Na network interface for receiving an input 
5 stream comprslsing a plurality of characters; 

a processor communicatively coupled to the 
computer readabPfe medium and the network interface; 

a state \able stored upon the computer readable 
medium, the state taJ:sd.e indexed such that inputs 
10 comprising a current s\ate and a current character yield 
an output of a new state\ the new state related to an 
attack on a computer netwoVk; and 

a state machine comprising instructions stored 
upon the computer readable meaSLum and executable by the 
15 processor, the state machine communicatively coupled to 
the state table, the state machinX operable to: 

maintain the current \state ; 
select a first character of the input 
stream as the current character; and \ 
2 0 compare the current character and the 

current state to the state table to generate a new state. 
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